Remote SCIM token disclosure via timing leak

A covert timing channel in Zulip Server 5.0 through 5.6 allows remote attackers to infer SCIM bearer tokens via repeated failing requests. The validate_scim_bearer_token function compared the Authorization header with ordinary equality instead of constant_time_compare, making response timing dependent on matching characters. SCIM account management must be enabled; a recovered token can impersonate the SCIM client to read and update user accounts, while the vendor reports exploitation as theoretically possible and impractical in practice.